|  | 6.6 | Using ACLs with protocols
| 6.6.1 | Protocols for which ACLs can be created
ACLs can control most protocols on a Cisco router. You enter a number in the protocol number range as the first argument of the global ACL statement. The router identifies which ACL software to use based on this numbered entry. Many ACLs are possible for a protocol. You select a different number from the protocol number range for each new ACL; however, you can specify only one ACL per protocol per interface. For some protocols, you can group up to two ACLs to an interface: one inbound ACL and one outbound ACL. With other protocols, you group only one ACL, which checks both inbound and outbound packets. If the ACL is inbound, when the router receives a packet, the Cisco IOS software checks the ACL's condition statements for a match. If the packet is permitted, the software continues to process the packet. If the packet is denied, the software discards the packet by placing it in the bit bucket. If the ACL is outbound, after receiving and routing a packet to the outbound interface, the software checks the ACL's condition statements for a match. If the packet is permitted, the software transmits the packet. If the packet is denied, the software discards the packet by sending it to the bit bucket.
| Engineering Journal
| Naming or Numbering an IP Protocol